JavaScript Fingerprinting & Bot Detection: How Websites Identify You
Key Takeaways
- JavaScript fingerprinting collects 50+ browser characteristics to create a unique identifier, more persistent than cookies and harder to block.
- Key fingerprinting signals include Canvas, WebGL, AudioContext, fonts, screen properties, and navigator API data.
- Anti-bot systems combine JS fingerprinting with TLS fingerprinting (JA3/JA4) and behavioural analysis for highly accurate bot detection.
- Headless browsers (Puppeteer, Playwright) and automation tools leave detectable traces that fingerprinting exposes, missing APIs, identical outputs, timing anomalies.
- Spoofing fingerprints is possible but increasingly difficult, anti-bot systems use consistency checks that catch mismatched spoofed values.
Table of Contents
Every time you visit a website, your browser silently reveals dozens of unique characteristics - your screen resolution, GPU model, installed fonts, audio processing quirks, and the exact way your browser renders invisible canvas elements. Combined, these signals create a browser fingerprint that's as unique as a human fingerprint.
This technology powers modern bot detection systems, fraud prevention, and anti-automation defences. Understanding how it works is essential whether you're defending your website from bots or trying to understand why certain security systems challenge your traffic.
What Is JavaScript Fingerprinting?
JavaScript fingerprinting is a technique that uses browser-side JavaScript APIs to collect device and environment characteristics, creating a unique identifier for each browser session. Unlike cookies (which users can delete) or IP addresses (which change), fingerprints are:
- Persistent: Survive cookie clearing, private browsing, and browser restarts
- Unique: The combination of 50+ signals creates fingerprints that are unique across millions of browsers
- Passive: Collection happens invisibly without user interaction
- Hard to spoof: Changing one signal often creates detectable inconsistencies with others
How Browser Fingerprinting Works
A fingerprinting script typically runs in three phases:
- Collection: JavaScript APIs query browser properties - navigator object, screen properties, canvas rendering, WebGL capabilities, AudioContext processing, etc.
- Hashing: Collected values are combined and hashed (usually SHA-256 or MurmurHash3) into a compact fingerprint string
- Comparison: The hash is compared against known fingerprints - matching a previous visitor, a known bot tool, or a spoofed environment
Key Fingerprinting Signals
Canvas Fingerprinting
The most powerful fingerprinting signal. A hidden <canvas> element draws text, shapes, and gradients. The pixel-by-pixel output varies based on GPU, driver version, font rendering engine, and anti-aliasing implementation. Two different devices almost never produce identical canvas output.
WebGL Fingerprinting
WebGL exposes GPU information (renderer, vendor) and produces unique rendering output. The WEBGL_debug_renderer_info extension reveals the exact GPU model. Combined with WebGL rendering tests, this creates a strong hardware fingerprint.
AudioContext Fingerprinting
The Web Audio API processes audio signals differently on each device due to hardware and software differences. By generating an oscillator and analysing the output, fingerprinting scripts capture unique audio processing characteristics.
Font Fingerprinting
Different OS versions, language packs, and installed applications add unique font collections. By measuring the rendering width/height of text in various fonts, scripts determine which fonts are installed - creating a font-based fingerprint.
Navigator & Screen Properties
| Signal | What It Reveals | Entropy |
|---|---|---|
| navigator.userAgent | Browser version, OS, device type | Medium (easily spoofed) |
| navigator.language | Preferred language(s) | Low-Medium |
| navigator.hardwareConcurrency | CPU core count | Low |
| navigator.deviceMemory | RAM amount (approximate) | Low |
| screen.width/height | Display resolution | Medium |
| screen.colorDepth | Colour depth capability | Low |
| navigator.platform | OS platform string | Low (deprecated) |
| navigator.maxTouchPoints | Touch capability | Low |
| Intl.DateTimeFormat().resolvedOptions().timeZone | Time zone | Medium |
Additional High-Value Signals
- WebRTC leak: Can reveal local and public IP addresses even through VPNs
- Battery API: Battery level and charging status (deprecated in most browsers due to privacy)
- Permission states: Whether notifications, geolocation, camera permissions have been granted or denied
- Client hints: Chrome's User-Agent Client Hints provide structured device data
- CSS media queries: Detect dark mode preference, reduced motion, contrast preferences
TLS Fingerprinting (JA3/JA4)
TLS fingerprinting operates at the connection level, before any JavaScript runs:
JA3 Fingerprinting
Created by Salesforce, JA3 hashes the TLS Client Hello message components: SSL version, ciphers, extensions, elliptic curves, and EC point formats. Each HTTP client (Chrome, Firefox, Python requests, Go http, curl) produces a unique JA3 hash. This identifies the actual client software even when user-agent headers are spoofed.
JA4 Fingerprinting
The newer JA4 standard improves on JA3 with a more human-readable format and better version tracking. It creates a fingerprint string like "t13d1715h2_8daaf6152771_b0da82dd1658" that encodes TLS version, cipher count, extension count, and ALPN values.
How Anti-Bot Systems Use Fingerprinting
Modern anti-bot solutions like Cloudflare Bot Management, Akamai Bot Manager, and DataDome combine fingerprinting with multiple detection layers:
- TLS fingerprint check: Verify the connection comes from a real browser, not an HTTP library
- JavaScript execution: Run fingerprint collection scripts, bots that can't execute JS are immediately flagged
- Consistency validation: Check that the JS fingerprint matches the TLS fingerprint (for example, if JA3 says Chrome but canvas says headless, flag it)
- Known bot comparison: Compare fingerprint against database of known bot tool signatures
- Behavioural overlay: Combine fingerprint score with mouse movement, click timing, and scroll patterns
Detecting Headless Browsers
Headless browsers (Chrome headless, Puppeteer, Playwright) leave telltale signs:
- navigator.webdriver: Set to
truein automated browsers (can be spoofed but detected via prototype checks) - Missing chrome object:
window.chromeis absent or incomplete in headless Chrome - Plugin count: Real Chrome reports plugins; headless Chrome typically reports zero
- WebGL vendor mismatch: Headless environments often report "Google Inc. (Google SwiftShader)", a software renderer
- Notification permission: Headless browsers can't request notification permission, revealing them through API behaviour
- Iframe contentWindow: Headless Chrome handles cross-origin iframe access differently
- Timing anomalies: Automated browsers execute JavaScript at inhuman speed or with perfectly consistent timing
Fingerprint Spoofing & Anti-Detection
Several tools attempt to modify browser fingerprints:
| Tool | Approach | Detection Risk |
|---|---|---|
| GoLogin | Custom Chromium with configurable fingerprint profiles | Medium |
| Multilogin | Mimic browser with deep fingerprint customisation | Medium |
| Puppeteer Extra (Stealth) | Plugin that patches detectable Puppeteer artefacts | Medium-High |
| undetected-chromedriver | Modified ChromeDriver that avoids common detections | Medium-High |
| Browser extensions | Canvas blocker, WebGL spoofing | High (adds detectable artefacts) |
Defence Strategies for Website Owners
If you're protecting your website from bots, implement fingerprinting as part of a layered defence:
- Use a managed solution: Cloudflare, Akamai, or DataDome handle fingerprinting at scale
- Combine with rate limiting: Fingerprinting identifies bots; rate limiting constrains their impact
- Add behavioural analysis: Fingerprinting + mouse tracking + click timing = comprehensive detection
- Deploy on DDoS-protected infrastructure: Fingerprinting runs at the application layer - you need network-level DDoS protection too
- Update detection regularly: Bot tools evolve; your detection must evolve faster
Privacy Implications
Browser fingerprinting raises significant privacy concerns. Major browsers are increasingly restricting fingerprinting capabilities:
- Firefox: Offers fingerprint resistance mode that normalises canvas, WebGL, and other outputs
- Safari: Limits canvas readback and restricts font enumeration
- Chrome: Reducing user-agent information through Client Hints and Privacy Sandbox
- GDPR/Privacy laws: Fingerprinting may constitute personal data collection requiring consent in the EU
Protect Your Website from Bot Attacks
Our security team implements comprehensive bot detection, fingerprinting, DDoS protection, and WAF configuration for websites and applications under attack.
Telegram: @unlednetwork → WhatsApp Us →
Comments
Have a question or a first-hand experience with this? Join the conversation. Your email is never shown or shared.
We implemented this last month and already seeing positive signals.
Thanks for the feedback. Based on our experience across hundreds of accounts, this approach shows results within 2-4 weeks.